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Abstract 

The  use  of  Unmanned  Air  Vehicles  (UAVs)  over 
the  past  several  years  has  become  an  important 
concept  for  military  operations.  Currently, 
multiple  UAV  flights  are  not  performed  due  to 
the  difficulty  in  the  control  algorithms  and  the 
lack  of  redundancy  to  handle  failures.  Control 
algorithm  designs  can  be  achieved  to  provide  for 
multiple  UAV  operations  but  single  thread 
system  failures  remains  a  problem.  Also, 
unforeseen  circumstances  such  as  ground 
controllers  flying  the  wrong  course  can  cause  air 
vehicles  to  arrive  in  the  same  airspace  at  the 
same  time,  which  can  cause  a  collision.  Even  in 
the  case  of  autonomous  UAV  operation,  flight 
management  errors  could  result  in  time  of  arrival 
errors  and  air  vehicle  collisions.  As  more  of 
these  systems  are  utilized,  the  methods  to 
control  them  become  even  more  difficult  and  the 
possibility  of  something  going  wrong  increases. 
There  is  also  a  desire  to  enable  UAV  flights 
within  commercial  airspace.  This  desire  cannot 
be  achieved  until  a  proven  method  to  prevent 
air-to-air  collisions  is  implemented. 

The  design  of  an  Automatic  Air  Collision 
Avoidance  System  (Auto  ACAS)  is  intended  to 
prevent  air-to-air  collisions  between  air  vehicles. 
The  Auto  ACAS  is  not  intended  to  replace 
existing  designs  such  as  the  Traffic  Alert  and 


Collision  Avoidance  System  (TCAS)  but  is 
intended  to  accomplish  a  recovery  at  the  last 
instant  to  prevent  a  collision.  TCAS  and  other 
systems  in  use  today  provide  situational 
awareness  and  traffic  advisories  to  enable  pilots 
to  perform  de-confliction  and  manual  avoidance 
maneuver  and  remain  several  miles  apart.  In 
contrast,  Auto  ACAS  assumes  such  de- 
confliction  and  manual  avoidance  attempts  have 
not  succeeded  and  operates  in  a  time  span  that 
does  not  allow  for  manual  pilot  reactions,  thus  it 
must  be  highly  integrated  and  automated  in 
operation.  An  automated  TCAS  could  be  used 
to  keep  apart  UAVs  and  commercial  airliners  but 
this  kind  of  design  may  be  difficult  to  implement 
due  to  the  fact  that  it  was  initially  designed  to 
instruct  the  pilot  to  make  course  changes  and 
not  automatically  take  control  of  the  aircraft. 
Automatic  collision  avoidance  is  necessary  if 
Unmanned  Aerial  Vehicles  (UAVs)  are  to 
“blacken  the  sky"  in  massed  attacks,  accompany 
manned  fighters  on  combat  missions,  and 
transition  civil  airspace.  These  vehicles  will,  in 
some  manner,  have  to  “see  and  avoid”  other 
aircraft.  An  automated  air  collision  avoidance 
system  will  fulfill  a  part  of  this  need.  It  will 
automatically  maneuver  an  aircraft,  at  the  last 
instant,  to  avoid  an  air-to-air  collision.  It  will 
function  in  a  manner  similar  to  a  pilot  avoiding  a 
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collision.  It  is  a  system  that  must  be  reliable, 
verifiable,  and  partially  redundant,  forming  the 
last  line  of  defense  against  collisions.  It  must 
provide  nuisance  free  operation  and  allow  safe 
interoperability.  The  requirements  for  such  a 
system  will  be  discussed  in  detail.  Of  particular 
interest  are  criteria  to  enable  a  safe,  nuisance 
free  system  that  will  have  embedded  rules  of  the 
road  for  all  encounters.  Autonomous  control  of 
unmanned  aerial  vehicles  is  a  goal  for  the  U.S. 
Air  Force  in  the  future.  However,  flying  multiple 
unmanned  vehicles  in  the  same  tactical  airspace 
with  manned  fighters  presents  very  challenging 
problems.  Automatic  collision  avoidance  is  a 
necessary  step  in  moving  toward  this  goal. 

Introduction 

Tomorrow's  Air  Force  will  use  Unmanned  Air 
Vehicles  (UAV)  for  a  number  of  missions.  High 
risk  missions  in  which  pilot  loss  is  unacceptable 
are  ideal  candidates  for  such  vehicles. 
Swarming  large  numbers  of  UAVs  to  saturate 
enemy  defenses  and  bring  overwhelming  force 
to  a  conflict  for  extended  periods  of  time  is 
another  possibility.  Whatever  missions  are 
chosen  for  these  vehicles,  their  numbers  and 
use  will  significantly  increase  in  the  future.  A 
way  must  be  found  to  allow  safe  operation  with 
manned  aircraft  in  the  same  airspace.  Collision 
prevention  is  also  required  when  close  flight  with 
other  aircraft  is  necessary  for  formation, 
refueling,  and  combat  training. 

To  allow  greater  autonomy  of  operation,  the 
onboard  software  programs  for  unmanned 
vehicles  are  growing  at  a  high  rate.  On  manned 
fighters,  a  large  amount  of  software  is 
considered  mission  critical  since  the  pilot  can 
intervene  in  the  event  of  a  program  error. 
However,  on  unmanned  vehicles  this  software 
and  all  of  the  programs  that  emulate  the  pilot's 
decision  process  are  safety-of-flight  critical.  The 
ability  to  validate  and  verify  this  software  is  an 
ever-increasing  problem. 

The  Auto  ACAS  program  began  in  the  year 
2000,  when  officials  at  the  U.S.  Air  Force  Safety 
Center  (AF/SE)  at  Kirtland  AFB,  N.M  asked 
AFRL  to  design  and  implement  an  Automatic  Air 
Collision  Avoidance  System  for  manned  fighters. 
The  U.S.  and  the  Kingdom  of  Sweden  had 
entered  into  a  Project  Agreement  (PA)  under  a 
Technology  Research  and  Development 
Program  (TRDP)  for  the  Automatic  Ground 
Collision  Avoidance  System  (GCAS)  program 
several  years  ago.  Sweden  had  been  interested 
in  preventing  air-to-air  mishaps  also,  so  they 


again  approved  of  a  second  PA  under  the  TRDP 
for  the  Auto  ACAS  program.  The  Boeing 
Company,  Lockheed  Martin  Aeronautics,  and 
Saab  AB  were  contracted  to  conduct  a  concept 
study  from  May  2000  to  March  2001.  The 
concept  study  results  indicated  that  it  was 
feasible  to  design  an  Auto  ACAS. 

Why  Automatic 

The  definition  of  a  manual  system  is  one  that 
produces  a  warning  to  the  pilot  to  take  an  action. 
These  warnings  can  be  in  the  form  of  aural, 
visual,  or  both.  The  timing  of  these  warnings  is 
the  basic  issue  as  to  why  an  automatic  system  is 
superior.  The  timing  depends  on  the  specific 
pilot  and  how  he/she  perceives  a  warning.  A 
warning  too  soon  can  be  perceived  as  a 
nuisance  for  some  pilots  and  too  late  a  warning 
may  not  give  the  pilot  enough  time  to  react.  The 
balance  on  timing  can  never  be  designed 
correctly  do  to  the  fact  that  everyone  has 
different  perceptions  and  capabilities.  Many 
studies  have  been  conducted  both  in  simulation 
and  in  flight  to  try  to  obtain  a  correct  design.  The 
mishaps  have  continued  to  vary  over  the  years 
but  never  have  been  zero. 

In  contrast,  an  automatic  system  does  not 
depend  on  pilot  reaction.  The  system  makes  the 
decision  to  react  and  can  be  adjusted  to  react  at 
the  last  instant  so  that  the  perception  of 
nuisance  is  virtually  eliminated. 

The  automatic  design  does  not  completely 
eliminate  the  nuisance  factor.  In  fact  it  becomes 
more  important.  The  pilot/operator  must  be 
satisfied  that  the  automatic  maneuver  activates 
at  the  proper  time  and  accomplishes  the  correct 
maneuver.  If  an  automatic  maneuver  activates 
too  soon,  the  pilot/operator  will  have  the 
perception  that  he/she  could  have  performed  the 
maneuver  and  not  need  the  automatic  system. 
Of  course  if  it  activates  too  late  the  result  would 
be  catastrophic.  A  too  early  activation  will  also 
create  the  nuisance  factor.  It  needs  to  activate 
after  the  pilot/operation  would  normally  activate 
the  same  escape  maneuver. 

There  are  reasons  why  automatic  systems  have 
been  avoided  in  the  aerospace  industry.  The 
most  apparent  reason  is  the  fact  that  no 
pilot/operator  is  content  to  give  up  control  of 
his/her  air  vehicle  to  a  computer.  Another 
important  reason  is  that  to  accomplish  the 
automatic  function,  flight  control  must  interface 
with  various  avionic  subsystems.  This  has  been 
fought  within  the  aerospace  industry.  Flight 
control,  due  to  its  importance  in  the  air  vehicles 
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survivability,  must  have  several  orders  of 
magnitude  greater  loss  of  function  than  other 
avionics  subsystems.  Redundancy  is  applied  to 
flight  control  systems  to  achieve  this  greater 
protection  against  loss  of  function.  It  has  been 
thought  that  if  redundant  systems  were  to 
interface  with  single  thread  systems,  the  result 
would  be  that  the  single  thread  system 
characteristics  would  become  dominant.  This 
thinking  has  led  to  the  many  manual  collision 
avoidance  systems  within  the  aerospace 
industry  today. 

Another  issue  that  caused  manual  dominance 
was  cost.  A  manual  system  only  needs  to 
implement  avionics  subsystems  that  are 
currently  on  the  aircraft.  Displays  are  available 
to  allow  added  functions  to  give  cautions  and 
warnings  to  the  pilot.  The  design  of  an 
automatic  system  must  include  the  flight  control 
system.  More  testing  is  required  which  drives 
the  cost. 

There  is  one  technology  that  has  implemented 
automatic  operation  and  that  is  in  Terrain 
Following  (TF).  It  is  not  clear  exactly  why  this 
technology  has  utilized  the  automatic  concept 
except  that  it  is  highly  demanding  to  manually  fly 
an  aircraft  at  low  altitudes  over  rolling  terrain. 
However,  even  in  the  case  of  TF,  the  systems 
always  had  a  manual  mode. 


System  Requirements 

Based  on  the  concepts  and  discussions  above, 
a  set  of  system  requirements  can  be  established 
for  an  automated  air  collision  avoidance  system: 


1)  The  system  must  provide  a  last 
resort  emergency  automatic 
maneuver  to  prevent  collisions  with 
other  air  vehicles.  This  requirement 
is  necessary  to  prevent  nuisance 
activation. 

2)  The  system  will  not  interfere  with 
normal  vehicle  control  except  to 
prevent  aircraft  loss.  It  is  to  be 
nuisance  free. 

3)  The  system  is  to  provide  a 
predictable  response  operating  as 
the  pilot  would  to  avoid  a  collision. 

4)  The  automatic  escape  maneuver 
will  be  commanded  only  long 


enough  to  avoid  the  collision. 
Termination  criteria  will  be 
established. 

5)  The  system  is  to  protect  against 
unforeseen  events  that  cause 
collisions. 

6)  The  system  can  be  relied  upon  to 
insure  safe  vehicle  operation.  It  will 
be  fully  verified,  validated,  and 
tested  with  redundant  elements  as 
required. 

7)  The  system  will  make  extensive  use 
of  distributed  integrity  monitoring  to 
insure  fail-safe  operation  without  the 
use  of  brute  force  redundancy. 

8)  The  system  will  be  designed  to 
operate  with  GPS  or  data  link  loss. 

Time-To-Escape 

Air  Traffic  advisories  and  warnings,  flight  path 
de-confliction,  and  aircraft  collision  avoidance 
seem  to  imply  similar  requirements  for  a  vehicle. 
In  this  paper  these  actions  are  shown  to  be  quite 
different  and  easily  separated  by  their  time  of 
action. 

Collision  avoidance  is  concerned  with  the  last 
minute  emergency  maneuver  to  prevent  aircraft 
loss.  It  is  not  concerned  with  traffic 
advisories/warnings  or  de-confliction.  One  good 
way  to  separate  these  functions  is  to  consider 
the  time,  prior  to  a  potential  collision,  during 
which  the  systems  are  expected  to  operate. 

The  aircraft  maneuvering  to  avoid  a  collision 
requires  a  finite  time  to  obtain  separation 
distance.  Thus,  a  point  in  time  can  be  defined, 
along  the  predicted  trajectory  of  one  aircraft,  for 
the  initiation  of  a  defined  "escape  maneuver" 
that  will  just  touch  the  other  aircraft. 
Maneuvering  at  or  beyond  this  point  will  not 
prevent  the  collision.  This  point  is  defined  as  the 
zero  seconds  time-to-escape  initiation  point 
since  there  is  no  time  left  to  prevent  the  collision 
due  to  the  physical  maneuver  constraints  of  the 
avoiding  aircraft.  Moving  back  in  time  from  this 
point  along  the  predicted  trajectory  yields  the 
time  available  to  escape  a  collision. 

This  concept  of  time-to-escape  comes  from  the 
flight  testing  of  an  automatic  ground  collision 
avoidance  system  by  the  US  Air  Force  at 
Edwards  AFB  in  California.  To  illustrate  the 
concept,  consider  two  vehicles  on  a  collision 
path  as  shown  in  Figure  1.  The  vehicle  on  the 
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left  is  to  initiate  an  automatic  escape  maneuver. 
Since  the  vehicles  are  within  a  “tracking  zone,” 
their  trajectories  are  being  predicted  and  the 
vehicle  on  the  left  determines  the  collision  point. 
The  collision  avoidance  system  is  designed  to  fly 
a  path  that  will  remain  clear  of  the  other  aircraft. 


Figure  1.  Time  Separation  of  Functions 


The  maneuver  is  moved  along  the  aircraft's 
future  trajectory  by  advancing  its  initiation  point. 
Beyond  this  point,  the  escape  maneuver  cannot 
prevent  collision.  The  point  at  which  a  pilot 
would  initiate  a  last-minute  escape  maneuver  is 
then  established.  In  this  example,  a  point  1.5 
seconds  prior  to  the  zero  seconds  time-to- 
escape  maneuver  point  is  selected. 

The  recovery  trajectory  defines  the  temporal 
sphere  of  collision  avoidance.  An  automatic 
collision  avoidance  system  must  initiate  between 
these  points,  maneuvering  within  the  collision 
avoidance  sphere,  if  it  is  not  to  interfere  with  the 
pilot  and  provide  the  desired  protection.  The 
distance  at  which  the  system  must  initiate  an 
escape  maneuver  changes  with  each  encounter 
geometry.  However,  the  time  over  which  it  must 
react  remains  constant.  Thus  it  is  easier  to 
visualize  system  operation  by  considering 
temporal  spheres  whose  radii  are  measured  in 
time. 

In  an  actual  system  an  exclusion  zone 
consisting  of  a  physical  distance  around  the 
target  vehicle  will  be  pre-established.  The 
system  will  prevent  penetration  of  the  exclusion 
zone.  The  tracking  zone  in  which  neighboring 
aircraft  are  observed  is  centered  on  the  vehicle 
with  the  automatic  collision  avoidance  system. 
The  collision  avoidance  and  deconfliction 
spheres  are  projected  onto  the  neighboring 
aircraft  that  pose  a  collision  threat.  Although 
useful  for  visualization,  in  practice  a  sphere  is 
not  calculated.  The  initiation  point  on  the  sphere 
is  calculated.  The  sphere  is  the  solution  of  all 


potential  collisions  with  the  vehicle  from  all 
aspects.  We  are  interested  in  only  one  solution 
at  any  time. 

By  using  this  time-to-escape  parameter,  we  can 
separate  the  areas  of  interest  for  traffic 
advisories,  conflict  resolution,  and  collision 
prevention.  UAV  deconfliction  operates  in  the 
25  seconds  time-to-escape  range.  Note  that 
deconfliction  is  concerned  with  attempting  to 
resolve  potential  collisions  at  a  range  that  allows 
the  mission  to  continue  without  major  replaning. 
Traffic  warnings  and  advisories  for  TCAS  occur 
at  in  a  25  to  45  seconds  time-to-escape  zone. 
Collision  avoidance  assumes  that  TCAS 
advisories  and  autonomous  deconfliction  have 
failed  to  resolve  the  problem. 

Integration  Safety 

Flight  control  systems  are  designed  with 
redundancy  to  achieve  the  required  loss  of 
control  parameter.  Systems  are  usually  triplex 
or  quad  redundant  in  order  to  achieve  this 
parameter.  In  a  quad  system,  a  first  failure  is 
voted  off  and  the  system  continues  to  operate  as 
a  triplex  system.  A  second  like  failure  will  again 
be  voted  off  and  the  system  continues  to 
operate  as  a  dual  system.  These  systems  are 
called  two  fail  operate. 

If  a  single  thread  avionics  subsystem  is 
integrated  into  the  flight  control  system,  one 
method  of  failure  detection  is  to  create  a  similar 
function  utilizing  redundant  subsystems.  An 
example  that  has  been  employed  is  to  utilize  the 
quad  flight  control  gyros  to  give  a  short  time 
calculation  for  an  Inertial  Navigation  System 
(INS).  The  INS  is  utilized  in  many  automatic 
maneuvers  to  provide  information  that  holds  the 
aircraft  in  a  certain  position  during  an  automatic 
maneuver.  Example:  Suppose  the  INS  has  a 
hard  over  failure.  Each  of  the  quad  digital  flight 
control  system  computers  monitors  the  INS  and 
when  the  failure  is  detected,  the  flight  control 
gyros  can  provide  data  for  the  flight  control 
computer  to  compute  the  INS  function  for  a  short 
time  period.  The  time  required  is  normally  very 
short  due  to  the  short  duration  of  the  automatic 
maneuver. 

There  are  other  types  of  methods  to  ensure  safe 
avionics  integration  such  as  sending  a 
calculation  for  an  avionics  computer  to 
accomplish.  Designing  a  coded  message  that 
the  avionics  computer  sends  at  a  specific 
periodic  rate  is  also  a  method  employed. 


Data  Link  versus  Sensor  Operation 

In  the  early  discussions  on  program  plans,  both 
sensors  and  data  links  were  considered  for  the 
design  of  the  Auto  ACAS.  Surveys  were 
conducted  to  determine  availability  and  whether 
specific  technologies  could  meet  the  Auto  ACAS 
requirements.  One  of  the  driving  points  for 
making  the  decision  was  that  whatever 
technology  was  chosen,  it  required  to  be 
integrated  onto  an  aircraft  and  flight  tested.  It 
was  determined  that  integrating  a  data  link  was 
less  costly  than  a  sensor.  This  was  of  course 
only  for  a  new  sensor.  The  existing  radar  on  the 
aircraft  could  be  utilized.  Due  to  the  cost,  the 
decision  was  made  to  use  a  data  link. 

Algorithm  Development 

The  algorithm  development  began  early  in  the 
program.  It  was  initially  integrated  into  an  off 
line  desktop  simulator  called  D-Six.  The  D-Six 
simulator  has  been  a  valuable  tool  to  test  the 
algorithm  in  the  early  stages  of  development.  It 
has  also  been  used  along  with  the  real  time 
simulation  testing. 

The  algorithm  interface  design  was  frozen  early 
in  the  program  so  that  the  integration  for  the  F- 
16  could  progress  without  interface  changes. 
This  process  allowed  the  algorithm  to  go  through 
several  releases  that  improved  performance. 

The  algorithm  utilizes  a  claim  space  method  to 
predict  where  the  aircraft  will  be  at  a  given  time. 
Figure  2  shows  the  escape  maneuvers.  The 
cones  produced  are  a  result  of  uncertainties  due 
to  navigation  errors. 

The  size  of  the  claimed  space  is  computed  using 
knowledge  of  the  wingspan,  navigation 
uncertainty  and  accuracy  of  the  predicted 
trajectory  compared  to  the  one  the  automatic 
digital  flight  control  system  (DFLCS)  will  make 
the  aircraft  follow  if  the  escape  command  is 
given. 

Each  aircraft  sends  its  predicted  escape 
maneuver  and  the  size  of  the  claimed  space 
along  this  track  to  the  other  aircraft,  using  the 
data  link. 


Fig.  2.  Collision  detection  using  predicted 
escape  maneuvers 

Escape  Maneuvers 

The  Auto  ACAS  algorithm  has  two  basic  escape 
maneuvers.  One  is  to  pull  5  g’s  for  piloted 
tactical  aircraft,  and  to  pull  the  maximum  g 
available  for  Unmanned  Air  Vehicle  (UAV).  The 
other  is  to  roll  at  the  roll  rate  of  60  degrees  per 
second  for  piloted  tactical  aircraft,  and  to  roll  at 
the  maximum  roll  rate  for  UAV;  followed  by  pull 
as  in  the  first  escape  maneuver.  Calculating  the 
amount  of  angle  needed  to  roll  the  wings  parallel 
to  the  collision  plane  generates  the  roll 
command. 

To  meet  the  nuisance  criteria,  the  algorithm  was 
designed  to  initiate  the  execution  of  the  selected 
escape  maneuver  at  the  last  moment  before  the 
collision  becomes  inevitable,  and  to  terminate 
the  escape  maneuver  as  soon  as  the  minimum 
separation  distance  is  reached.  Thus  it 
performs  the  collision  avoidance  with  minimum 
interference  to  the  pilot. 

Flight  Test 

One  of  the  test  aircraft  chosen  for  the  flight  test 
was  the  Variable  Stability  In  Flight  Simulator 
Test  Aircraft  or  VISTA/F-16.  The  reason  for 
VISTA  was  to  be  able  to  simulate  a  UAV.  The 
Auto  ACAS  algorithm  will  be  integrated  into  the 
Variable  Stability  System  (VSS)  computer  on 
VISTA.  The  VSS  is  a  computer  that  provides 
the  simulation  capability  for  VISTA.  For  the  Auto 
ACAS  program,  VISTA  would  have  two 
purposes,  to  simulate  an  F-16  and  to  simulate  a 
UAV.  The  second  aircraft  for  the  flight  test  is  an 
F-16. 

The  flight  test  was  divided  into  four  sessions  to 
provide  data  link  tests  and  an  early  look  at  the 
algorithm.  The  sessions  are  listed  below. 
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Session  I 

Data  link  transmissions  between  VISTA  and  the 
D-Six  ground  station.  VISTA  with  a  virtual  target 
controlled  by  the  ground  station. 

Session  II 

VISTA  configured  as  an  UAV  and  flown  with  a 
virtual  target. 

Session  III 

First  flight  of  F-1 6  flown  with  a  virtual  target. 
Session  IV 

VISTA  flown  with  the  F-1 6.  VISTA  configured  as 
an  F-1 6  and  as  an  UAV. 


Conclusions 

The  flight  operation  of  the  Auto  ACAS  will  show 
that  an  algorithm  can  be  utilized  to  safely 
maneuver  a  manned  air  vehicle  automatically 
and  not  interfere  with  normal  pilot  operations.  It 
will  only  be  required  to  function  for  very  short 
time  periods  and  only  to  prevent  a  potentially 
fatal  mishap. 

Safe  operation  of  UAVs  and  manned  aircraft  in 
the  same  airspace  can  be  ensured  by  an 
automated  collision  avoidance  system  as 
discussed  in  this  paper.  It  will  be  used  to 
prevent  UAVs  from  hitting  other  aircraft  flying  in 
the  vicinity.  It  will  also  provide  the  capability  for 
UAVs  to  fly  close  together  and  prevent 
collisions.  The  Auto  ACAS  will  be  the  first 
necessary  step  in  providing  the  capability  to 
allow  swarming  of  hundreds  or  thousands  of 
UAVs. 

Position  uncertainty  and  data  latency  can 
significantly  impact  a  system’s  operation.  Both 
can  cause  an  escape  maneuver  initiation  sooner 
than  desired.  At  some  point,  these  effects  will 
result  in  interference  with  the  fighter  pilot  or  the 
UAV  operation.  Further  study  of  these  effects 
and  methods  to  accommodate  the  various 
requirements  described  are  needed.  These 
problems  will  arise  for  both  a  data  link  or  sensor 
based  system. 

The  system  at  the  current  stage  of  development 
indicates  that  it  can  provide  the  computational 
capabilities  needed  for  a  nuisance  free  design. 
Simulation  results  thus  far  have  shown  that  the 
Auto  ACAS  has  achieved  nuisance  free 
operation. 

Flight  testing  the  algorithm  will  be  the  final  step 
to  show  an  Auto  ACAS  design  that  will  provide 
collision  protection.  The  algorithm  will  be  ready 


to  transition  to  other  platforms  once  the  flight 
test  is  successfully  completed. 

The  successful  implementation  of  the  Auto 
ACAS  algorithm  will  be  a  tribute  to  the  hard  work 
and  teamwork  that  the  Auto  ACAS  program  has 
accomplished.  All  of  the  organizations 
mentioned  in  this  paper  contributed  to  this 
success. 
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